Re: [PATCH v5 0/2] MR7579: ntdll: Return STATUS_ACCESS_VIOLATION if ret_len is not writable

[Paul Gofman (＠gofman)]

I tested separately that the access violation with 0 length and invalid ret_length pointer is not due to invalid alignment (the tests succeeds on Win11 if using 0xdead0000 instead of '1'). Also I could not find any influence of input *ret_len value on the function status.

So I don't see any sane business we might have to *ret_len in NtQueryInformationThread to make such a change less artificial, that is probably some very specific Windows implementation detail or bug? While it is probably not all that surprising that some DRMs may be very picky about the function's exact behaviour, so maybe it can go in this way?